aboutsummaryrefslogtreecommitdiff
path: root/xorg-server/hw/xwin/winmultiwindowicons.c
diff options
context:
space:
mode:
authormarha <marha@users.sourceforge.net>2014-03-24 21:12:32 +0100
committermarha <marha@users.sourceforge.net>2014-03-24 21:12:32 +0100
commite0927d908a12c9c140458c355b29b884a7705f2d (patch)
tree360dbbd5a318ff84a951e4ca96df38393bc9783f /xorg-server/hw/xwin/winmultiwindowicons.c
parent41fea4472dec859ddec76bdfa7108ebec71de1e3 (diff)
downloadvcxsrv-e0927d908a12c9c140458c355b29b884a7705f2d.tar.gz
vcxsrv-e0927d908a12c9c140458c355b29b884a7705f2d.tar.bz2
vcxsrv-e0927d908a12c9c140458c355b29b884a7705f2d.zip
fontconfig libxcb mesa xserver git update 24 Mar 2014
xserver commit bf087659f0fb747c471e26c5b287c35877818040 libxcb commit e2813e1cde893f384fa620ff3c13493beebabe0c fontconfig commit 9260b7ec39c34ce68d74e16d47917290a8c3f35a mesa commit 0d99aef6c8a940e52afcbffa7091ff9c854ba120
Diffstat (limited to 'xorg-server/hw/xwin/winmultiwindowicons.c')
-rw-r--r--xorg-server/hw/xwin/winmultiwindowicons.c26
1 files changed, 20 insertions, 6 deletions
diff --git a/xorg-server/hw/xwin/winmultiwindowicons.c b/xorg-server/hw/xwin/winmultiwindowicons.c
index 0531ad6c7..93d389d46 100644
--- a/xorg-server/hw/xwin/winmultiwindowicons.c
+++ b/xorg-server/hw/xwin/winmultiwindowicons.c
@@ -372,13 +372,12 @@ winXIconToHICON(Display * pDisplay, Window id, int iconSize)
unsigned char *mask, *image = NULL, *imageMask;
unsigned char *dst, *src;
int planes, bpp, i;
- int biggest_size = 0;
+ unsigned int biggest_size = 0;
HDC hDC;
ICONINFO ii;
XWMHints *hints;
HICON hIcon = NULL;
uint32_t *biggest_icon = NULL;
-
static Atom _XA_NET_WM_ICON;
static int generation;
uint32_t *icon, *icon_data = NULL;
@@ -405,10 +404,25 @@ winXIconToHICON(Display * pDisplay, Window id, int iconSize)
(icon_data != NULL)) {
for (icon = icon_data; icon < &icon_data[size] && *icon;
icon = &icon[icon[0] * icon[1] + 2]) {
- /* Find an exact match to the size we require... */
+ winDebug("winXIconToHICON: %u x %u NetIcon\n", icon[0], icon[1]);
+
+ /* Icon data size will overflow an int and thus is bigger than the
+ property can possibly be */
+ if ((INT_MAX/icon[0]) < icon[1]) {
+ winDebug("winXIconToHICON: _NET_WM_ICON icon data size overflow\n");
+ break;
+ }
+
+ /* Icon data size is bigger than amount of data remaining */
+ if (&icon[icon[0] * icon[1] + 2] > &icon_data[size]) {
+ winDebug("winXIconToHICON: _NET_WM_ICON data is malformed\n");
+ break;
+ }
+
+ /* Found an exact match to the size we require... */
if (icon[0] == iconSize && icon[1] == iconSize) {
- winDebug("winXIconToHICON: found %lu x %lu NetIcon\n", icon[0],
- icon[1]);
+ winDebug("winXIconToHICON: selected %d x %d NetIcon\n",
+ iconSize, iconSize);
hIcon = NetWMToWinIcon(bpp, icon);
break;
}
@@ -421,7 +435,7 @@ winXIconToHICON(Display * pDisplay, Window id, int iconSize)
if (!hIcon && biggest_icon) {
winDebug
- ("winXIconToHICON: selected %lu x %lu NetIcon for scaling to %u x %u\n",
+ ("winXIconToHICON: selected %u x %u NetIcon for scaling to %d x %d\n",
biggest_icon[0], biggest_icon[1], iconSize, iconSize);
hIcon = NetWMToWinIcon(bpp, biggest_icon);